Court re-iterates that, by and large, we have no expectation of digital privacy.

In a criminal case on Wednesday, a federal judge denied (PDF) a motion to suppress evidence gathered with the help of a stingray—a device that can create a false cellphone tower signal.

The use of a stingray allows authorities to determine a specific mobile phone’s precise location. The technology isn't new and many believe law enforcement agencies nationwide have used them for many years.

In March 2013, we reported on an amicus brief filed in this case by the American Civil Liberties Union. This revealed that the Feds were not completely upfront about using stingrays (also known as “IMSI catchers”) when they asked federal magistrate judges for permission to conduct electronic surveillance.

As a result, Daniel David Rigmaiden (the defendant in the case who is representing himself and has maintained his innocence), had forcefully argued that using a stingray without a warrant is unconstitutional. As a result, he argues that any evidence gathered from it should be suppressed from the record. But the Court ultimately denied Rigmaiden's motion.

Rigmaiden faces dozens of federal accusations of identify theft, mail fraud, and other charges stemming from an alleged fraudulent tax refund ring. Between 2005 and 2008, federal investigators claimed that Rigmaiden and two co-conspirators—Ransom Marion Carter, III (who remains a fugitive) and another unnamed suspect—filed more than 1,900 fake tax returns online. Their work yielded $4 million sent to more than 170 bank accounts.

Privacy, schmivacy

Among other reasons for denial, Judge David Campbell said that Rigmaiden had no “reasonable expectation of privacy” when using a mobile Internet hotspot ("aircard") from Verizon. And ultimately, that's how law enforcement agents tracked him down and arrested him.

Virtually everything about Defendant’s actions related to the apartment was fraudulent. Defendant rented the apartment using the name of a deceased individual, provided a forged California driver’s license to support the false identity, used the driver’s license number from another person in support of the forged license, and provided a forged tax return to support his purported ability to pay rent. Defendant used the laptop he had procured through fraud in the apartment, and connected to the Internet with the aircard purchased with a false identity while using the account with Verizon that he maintained using a false identity. Even the electricity that lighted the apartment and powered the computer and aircard was purchased in a false name. What is more, while living in the apartment under false pretenses, Defendant had $70,000 in cash, a false passport, and a copy of his laptop computer in a storage unit (also rented under false pretenses) ready for a quick escape.

One who so thoroughly immerses himself in layers of false identities should not later be heard to argue that society must recognize as legitimate his expectation of privacy in the location and implements of his fraud. The Court concludes that Defendant’s presence in apartment 1122 was akin to the “burglar plying his trade in a summer cabin during the off season.”

Campbell, in his 52-page decision, also cited the 1976 case, United States v. Miller. That decision later helped influence the third-party doctrine:

The reasoning of Miller applies to the historical records obtained by the United States. They are not the customer’s private papers. Once a customer makes a call, communicates over the Internet, leases an apartment, or uses the services of an alarm company, he has no control over the business record made by the business of that transaction. Instead, the record created is a business record of the provider. The choice to create and store the record is made by the provider, and the provider controls the format, content, and duration of the records it chooses to create and retain. . . . Moreover, these records pertain to transactions to which the companies were a participant. The assignment of a particular cell tower to process a call is made by the cell phone company to facilitate the functioning of its network; the ISP uses the IP address to route Internet communications it transmits; the rental company maintains a rental file for each occupant; and an alarm service independently maintains records of the equipment it installs and maintains. Thus, under Miller, the business records obtained by the government are not protected by the Fourth Amendment.

The judge concluded:

Contrary to Defendant’s arguments, federal courts consistently rely on Smith and Miller to hold that defendants have no reasonable expectation of privacy in historical cell-site data because the defendants voluntarily convey their location information to the cell phone company when they initiate a call and transmit their signal to a nearby cell tower, and because the companies maintain that information in the ordinary course of business.

ACLU wants stingrays to be more explicitly disclosed

In a blog post published Wednesday, ACLU counsel Linda Lye wrote that law enforcement should be compelled to thoroughly disclose the implications of using a stingray device—as this technology can easily pick up other non-suspect mobile phones.

In today’s decision denying the motion to suppress, the judge held that information about how the stingray operates—such as the fact that it scoops up third party data—was merely a “detail of execution which need not be specified.” We respectfully but strongly disagree.

If the government has probable cause to believe a suspect lives at a particular address and wants a search warrant, it obviously needs to tell the court if the address is a 100-unit apartment building and that the government intends to search all 100 units until it finds the suspect. Omitting such information would never be considered a “detail of execution.” Law enforcement should be held to the same standard when they conduct electronic surveillance.

The judge dismissed the significance of the stingray’s impact on third parties because the government deleted and did not review the third-party data after it located Mr. Rigmaiden. But the Fourth Amendment does not include a “no harm, no foul” rule. The violation arises from the fact that the government searched people who are not suspected of any wrongdoing. This is a violation even if the government doesn’t later use the information against those third parties.

Cyrus Farivar
Cyrus is the Senior Business Editor at Ars Technica, and is also a radio producer and author. His latest book, Habeas Data, about the legal cases over the last 50 years that have had an outsized impact on surveillance and privacy law in America, is due out in May 2018 from Melville House. Emailcyrus.farivar@arstechnica.com//Twitter@cfarivar

One who so thoroughly immerses himself in layers of false identities should not later be heard to argue that society must recognize as legitimate his expectation of privacy in the location and implements of his fraud. The Court concludes that Defendant’s presence in apartment 1122 was akin to the “burglar plying his trade in a summer cabin during the off season.

What is this judge still doing on the bench when he appears incapable of distinguishing the necessary separation of constitutionality of evidence gathering from presumed or actual guilt of crimes?

What is troublesome is that the government feels that if it *might* be available in a record kept by the service provider, then the government can use any means to obtain that information. This seems like a 70 degree slope coated in Teflon and silicone lubricants. Miller applies to obtaining records after the fact from the service provider via subpoena or request. Stingray is a man in the middle that is eavesdropping on a subject as well as dozens of others in realtime. Quite a dangerous way to stretch precedent, even if the defendant is guilty of being such scum.

Will Miller next be stretched to allow the government to to break into the telco's or isp's offices in order to get these records? After all no one has any expectation of privacy over them. Would the government also be authorized to enter a suspects home in order to look through their bills and other copies of such records? After all, this is data the government could get without a warrant anyways...

One who so thoroughly immerses himself in layers of false identities should not later be heard to argue that society must recognize as legitimate his expectation of privacy in the location and implements of his fraud. The Court concludes that Defendant’s presence in apartment 1122 was akin to the “burglar plying his trade in a summer cabin during the off season.

What is this judge still doing on the bench when he appears incapable of distinguishing the necessary separation of constitutionality of evidence gathering from presumed or actual guilt of crimes?

Since he's guilty anyways, why bother with a trial? We should just give him the maximum sentence. It seems that's where we are going with our justice system, and it's quite frightening. Soon it will resemble a Kafka novel.

Of course, if he is guilty, this guy committed the worst possible sin against a government, not only was he not "rendering unto Caesar", but he was also robbing him. Therefore the government is going to have the long knives out after him. Such is a fact of life, but it's sad to see the constitution flushed further down the toilet in their zeal for revenge.

I wonder how many US Supreme Court justices would feel that their reasonable expectations of privacy had been violated if someone intercepted and decrypted their Wi-Fi internet or cell phone signals and posted it all on Wikileaks? How about US Attorney General Eric Holder? Would he say that he had no reasonable expectation of privacy in any digital communications if this happened to him?

I can only imagine what James Madison and Thomas Jefferson might have to say...

The Court reiterates a wrong viewpoint, is how I see this and one that should have the judge who reiterated it disbarred and removed from his seat.

Yes, in the digital age, we DO have privacy. Perhaps it's time that phones encrypted every single word of every single conversation so that the FBI and CIA cannot eavesdrop on us anymore. I would definitely go for that and my boss would definitely be willing to represent anyone who got in trouble over that in court.

The Feds and others have been overreaching for years at this point and I truly believe that it is going to take a violent revolution or a mass revolt on the part of American citizens to change things.

Contrary to Defendant’s arguments, federal courts consistently rely on Smith and Miller to hold that defendants have no reasonable expectation of privacy in historical cell-site data because the defendants voluntarily convey their location information to the cell phone company when they initiate a call and transmit their signal to a nearby cell tower, and because the companies maintain that information in the ordinary course of business.

Doesn't the provider only have a very rough idea of location, hence use of the stingray to obtain precise location?

My expectation with a phone is that the carrier doesn't know *exactly* where I am.

If dochebags like prenda need a subpoena to get the identity of a person behind the address why doesn't the gov need a warrant to know what imei is behind my phone? That most certainly isn't public information.

I didn't even need to read the article to grok the underlying truth. Get used to the fact that the airwaves are, very much, like fucking a goat in your front yard. If you don't put up a wall, anyone can see you do it.

Now the problem as I see it is that our legal system is simply not designed to handle the modern age. So many analogies and justifications seem to have to be made to be in accordance with past laws and rulings. Though, the digital revolution and Internet age are certainly unprecedented advances in society, the core foundation of our law, the idea and meaning behind the Constitution (not necessarily the exact text) should still stand.

E-mail/IM/SMS/VoIP/etc. should still be protected under the 4th amendment, because that is the intention behind it, to protect personal and private communication.

Location is a tough one to reconcile, in that if you are out on the street you really shouldn't expect privacy of your location, but you should be able to expect it in your home... if that makes sense.

In any case, fact of the matter is that we need to overhaul our legal system on so many levels to better serve our present day situation.... unfortunately the people in charge of this are only likely to change it for the worse, SOPA/PIPA/CISPA/etc.

I wonder how many US Supreme Court justices would feel that their reasonable expectations of privacy had been violated if someone intercepted and decrypted their Wi-Fi internet or cell phone signals and posted it all on Wikileaks? How about US Attorney General Eric Holder? Would he say that he had no reasonable expectation of privacy in any digital communications if this happened to him?

If any high ranking government official had been tracked this way, there would be legislation drafted the day after and passed in to law the day after that. BUT, that law would still be used against the common folk all the while exempting themselves from it.

Quote:

I can only imagine what James Madison and Thomas Jefferson might have to say...

The problem with this is any crook with half a brain is most likely going to use burner phones. "prepaid" Especially the ones making a lot of money, I mean what is the cost of a burner now $15 - 20$?

Their actions prove that they do not give a fuck about public interest at all. Which is pretty sad considering we are the ones that hire them. We hire them to look out for the best interest of the majority which they seem to forget very fast these days.

Year after year we're fed false information of how they're going to fix our country and people eat that shit up.. Now we're at the point where it does not matter because both sides play for the same team.

Christ, what an asshole! (The defendant, not the judge necessarily). I don't agree with the precedent, but they couldn't find a better test case than this one? It sounds like the only person who Rigmaiden told his real name to was his mother!

Better the ACLU sit this one out, then argue the next time and have this precedent set aside as Rigmaiden was defending himself and obviously not qualified.

The Court reiterates a wrong viewpoint, is how I see this and one that should have the judge who reiterated it disbarred and removed from his seat.

Yes, in the digital age, we DO have privacy. Perhaps it's time that phones encrypted every single word of every single conversation so that the FBI and CIA cannot eavesdrop on us anymore. I would definitely go for that and my boss would definitely be willing to represent anyone who got in trouble over that in court.

The Feds and others have been overreaching for years at this point and I truly believe that it is going to take a violent revolution or a mass revolt on the part of American citizens to change things.

Who would have thought that this country was born out of a revolt against an oppressive tyranny.

I'd love to know the true level of correlation between the people who claim: - the airwaves are free and if I want to leech my neighbor's wi-fi i'm completely within my rightsand ... - the airwaves are private and the government has no business touching my signal

I see a lot of kneejerk here. The guy got on the radar for fraud. To locate him they needed to penetrate his web of identity theft and use of cell data to communicate. They went to a judge and got "permission to conduct electronic surveillance". They surveiled this criminal turd and now he is going away for a long time.

I am especially outraged that he directly stole from the taxes I pay. This massively infringes my rights. I am filled with schadenfreude and also outright joy that he is going to spend long long time in jail.

I like that the judge did not let him shield his criminal acts (fraud) through his other criminal acts (identity theft). I get that privacy rights are important, but this is not a case of someone using aliases and having them violated. This is a case of someone using someones name (which I grant is an alias when used this way and privacy protected) but also stealing their social security number (which is a crime, not some privacy protected act). I know he stole the ssn because 1) that is why you use a dead person's name and 2) you can not get internets without a ssn.

There is no slippery slope here. There is no danger to others on the Stingray. They are not covered by the warrant, so anything they tell the stingray is inadmissible. This is just solid police work. Someone actually familiar with Stingray can tell us if it limits info to the target or just dumps everything as if it is Google Street View.

Finally, I realize everyone is paranoid because of meth, and rightly so because meth is bad m'kay and they may be coming for you. So please, ditch the meth and switch to pot. It will calm you down, you are likely able to buy it outright or with the small inconvenience of a prescription. It will chill you out and you can stop seeing Hitler and Stalin behind every post on Ars. This will let the rest of us relax in turn because the comments will be more real and without this fake police state hysteria.

I see a lot of kneejerk here. The guy got on the radar for fraud. To locate him they needed to penetrate his web of identity theft and use of cell data to communicate. They went to a judge and got "permission to conduct electronic surveillance". They surveiled this criminal turd and now he is going away for a long time.

I am especially outraged that he directly stole from the taxes I pay. This massively infringes my rights. I am filled with schadenfreude and also outright joy that he is going to spend long long time in jail.

I like that the judge did not let him shield his criminal acts (fraud) through his other criminal acts (identity theft). I get that privacy rights are important, but this is not a case of someone using aliases and having them violated. This is a case of someone using someones name (which I grant is an alias when used this way and privacy protected) but also stealing their social security number (which is a crime, not some privacy protected act). I know he stole the ssn because 1) that is why you use a dead person's name and 2) you can not get internets without a ssn.

There is no slippery slope here. There is no danger to others on the Stingray. They are not covered by the warrant, so anything they tell the stingray is inadmissible. This is just solid police work. Someone actually familiar with Stingray can tell us if it limits info to the target or just dumps everything as if it is Google Street View.

Finally, I realize everyone is paranoid because of meth, and rightly so because meth is bad m'kay and they may be coming for you. So please, ditch the meth and switch to pot. It will calm you down, you are likely able to buy it outright or with the small inconvenience of a prescription. It will chill you out and you can stop seeing Hitler and Stalin behind every post on Ars. This will let the rest of us relax in turn because the comments will be more real and without this fake police state hysteria.

I think they know to within about 50 feet. The "cell tower only" triangulation in the phone is much less accurate, but I think the towers, working in tandem, know where you are very well indeed.

No. Cell tower triangulation in the phone is radically more accurate than cell tower triangulation from the carrier.

The phone triangulation is reading the location of *every* tower that is within range including ones from carriers who will not let you connect to them. The carriers only know about either the single tower you are currently connected to, or all of the towers that they control.

In either case, the depends on how strong the tower transmitter is and how many towers are within range. Rural towers can transmit to everyone within a hundred miles if you have line of sight so they're not accurate at all. Metro towers might only cover 50 feet (a large indoor shopping mall or airport might hundreds short range towers, to make sure you have signal inside every shop even though each one has walls that are basically a faraday cage due to multi-story buildings are often constructed).

Stingray is even more accurate, since they can move it around while reading signal strength data. They can probably pick your location to within 1 or 2 feet if they bother to spend a long time gathering data.

Source: I've been programming against the iOS geolocation API's for years and I have friends who install and maintain cell tower hardware in both metro and remote areas of australia.

Welcome to Soviet America. Totalitarianism without the pesky Socialism.

If you see this fake-cell tower incident as an isolated issue it's worrisome. But when you add it as a puzzle piece to the greater picture (just look at todays articles e.g. FBI reading your emails) it gets frightening.

Glad for living in Western Europe where we still have civil rights and freedom.

I see a lot of kneejerk here. The guy got on the radar for fraud. To locate him they needed to penetrate his web of identity theft and use of cell data to communicate. They went to a judge and got "permission to conduct electronic surveillance". They surveiled this criminal turd and now he is going away for a long time.

I am especially outraged that he directly stole from the taxes I pay. This massively infringes my rights. I am filled with schadenfreude and also outright joy that he is going to spend long long time in jail.

I like that the judge did not let him shield his criminal acts (fraud) through his other criminal acts (identity theft). I get that privacy rights are important, but this is not a case of someone using aliases and having them violated. This is a case of someone using someones name (which I grant is an alias when used this way and privacy protected) but also stealing their social security number (which is a crime, not some privacy protected act). I know he stole the ssn because 1) that is why you use a dead person's name and 2) you can not get internets without a ssn.

There is no slippery slope here. There is no danger to others on the Stingray. They are not covered by the warrant, so anything they tell the stingray is inadmissible. This is just solid police work. Someone actually familiar with Stingray can tell us if it limits info to the target or just dumps everything as if it is Google Street View.

Finally, I realize everyone is paranoid because of meth, and rightly so because meth is bad m'kay and they may be coming for you. So please, ditch the meth and switch to pot. It will calm you down, you are likely able to buy it outright or with the small inconvenience of a prescription. It will chill you out and you can stop seeing Hitler and Stalin behind every post on Ars. This will let the rest of us relax in turn because the comments will be more real and without this fake police state hysteria.

Y'know, I'd try to point out your failure, but idk where to start.

Start with the first paragraph. Refute why the judge was wrong for granting them permission to conduct elecronic surveillance, for example.

Then for the second paragraph, make an argument along the lines of, "I'd rather let one hundred criminals go free than let an innocent man get locked up."

For the third paragraph, you can craft your arguments around how the end doesn't justify the means, and in the next paragraph argue that this is a slippery slope where we can expect Big Brother to fastrope down from helicopters, kick in our door, and cart us off to Gitmo.

And for the final paragraph, throw in a snarky comment about the war on drugs, or how quickly he's Godwin'd the argument, or something to get an emotional rise out of him.

Keep in mind that these are just suggestions. Hopefully this will help get you started on pointing out Azethoth666's failures.

They surveiled this criminal turd and now he is going away for a long time.

First, he's not a criminal until they actually convict him of being a criminal. Right now, the government has made a bunch of very loud assertions about this man, and you are swallowing these assertions whole. In your mind, he IS a bad man, based purely on how loudly the government is shouting.

Remember, as I've said before, in the American legal system, prosecutors are paid professionals at misconstruing evidence. And, given what we know about how bad their track record can be, especially in higher profile cases where their political careers will benefit if they successfully prosecute, you should never believe what they tell you, until they actually prove it beyond a reasonable doubt in front of a judge.

Basically, that's a long way of saying "you should assume innocence until guilt is proven".

Second: civil liberties are always violated for scumbags first. But it is only when the government hates you and wants you locked up or dead, that you actually need your liberties. If you only have rights when you're not accused of anything, you don't have them at all.

When you go into that full-throated attack on that man's rights, you are in full-throated attack of yours. Pray you never fall into the hands of a paid professional who deeply wants to lock you up to advance his political career.

edit: and note that I don't know that this is happening. That guy could totally be guilty. But it's not proven yet, and until it's proven, he has every right that anyone else does, and those rights should be zealously defended. You're not doing it for him, you're doing it for you.

Perhaps it's time that phones encrypted every single word of every single conversation so that the FBI and CIA cannot eavesdrop on us anymore. I would definitely go for that and my boss would definitely be willing to represent anyone who got in trouble over that in court.

In the U.S. GSM transmissions are encrypted using A5/1 encryption (http://en.wikipedia.org/wiki/A5/1). For the most part, all of your calls on AT&T and T-Mobile are covered by that. They do drop encryption if traffic gets too congested (it reduces overhead), but that's fairly rare. When the encryption is active it covers the internals of the call, such as the voice and sms messages. This also covers the data transmissions on the GSM side, both GPRS/EDGE and UMTS. It does not cover admin messages from tower to handset, such as the IMSI, TMSI, or Timing Advance values, those are all transmitted unencrypted.

If you use CDMA (Sprint - Verizon), well you're fucked. No encryption for you!

This is a simple issue. Someone obtained a wireless device and used it. When you do that, you lose control of the signals that are sent out and anyone that can is free to receive them (unless otherwise prohibited by law). The fact that you can receive them and use them to triangulate a location is not violating any constitutional right to unreasonable searches - that goes far beyond what the founders were intending.

While there is no direct historical equivalent, about the closest thing I can think of would be using flags to signal someone. You would not have been able to claim you had some privacy right that prevented anyone else from seeing those flag signals back in the 1700's and you don't have any right to claim someone is improperly receiving the modern equivalent now.

If you have a phone you can constantly be tracked via triangulation. If you don't like that, get rid of the phone. Personally, I find the convenience more than worth the loss of privacy - I can coordinate in ways that were impossible before the widespread availability of phones. But feel free to go to Montana, get a log cabin and stockpile a large amount of canned goods, all without a phone, if it makes you happier.

Couldn't they go after this kind of stuff via CFAA? It's not as if phone devices are meant to hook up to these fake phone towers in normal operation. In addition should a civilian attempt to do something like this it would definitely fall against the CFAA amongst other things.

I presume certain exemptions apply to police forces but I wonder how these are set up and whether something needs to be written into phone contracts and service agreements for example.